Terminal services on Windows 2003 server

[RobK]

Anyone know if you can enable logging for terminal services access, like when sessions are created and disconnected or reset?

[Hopsta]

Only logon auditing I know of is within the Security Event logs. You could just write a script which logged the comings and goings, on log on/off to a file.

Something like -

echo %username% >logon.txt

echo date >>login.txt

echo time >>login.txt

A tad rudamentry, but would do the job, only issue would be the file gettnig massive after a while, so would need to run a task to clear the file once in a while

Graham

[Belchy]

open up the local policy editor start > run > gpedit.msc and edit the local policy to audit account logon activity.

The policy is under computer configuration>windows settings>security settings>audit policy and is called "audit logon events" .

Select success and failure for a true picture

[RobK]

Thanks for that, but I was thinking about logging the TS sessions themselves. We have a system which runs apps in a disconnected TS session and the sessions occasionally get reset for no apparent reason. It would be handy if it would log when the session is closed and why.

[Belchy]

have you checked your RDP settings for timeouts?

[RobK]

Aha, just found there was a group policy that set the "end a disconnected session" setting to 1 day! It's odd because it didn't show up in the connection settings on the server

Well that shoud sort it, cheers guys